web app aai integration - switch · 2010-08-27 · web app aai integration how to integrate web...

$: Web app AAI Integration - SWITCH · 2010-08-27 · Web app AAI Integration How to integrate web applications with AAI in general? Montag, 8. ... • Zope + Plone\ More up-to-date$
Lukas Hä[email protected]

Zurich, 8. February 2009

Web app AAI Integration How to integrate web applications with AAI in general?

6Montag, 8. Februar 2010

mailto:[email protected]

mailto:[email protected]

© 2010 SWITCH

Goal of this presentation

1. List the general requirements for integrating AAI into a general web application (not SAP-specific)

2. Out-line what “AAI Integration” means and involves

3. Describe some technical aspects of the integration

7


© 2010 SWITCH

Some Terminology

Home OrganisationOperates an Identity Provider that authenticates a user and asserts identity information about this userin form of SAML assertions

ResourceConsists of Service Provider that protects one or more web-applications by enforcing authentication. Provides SAML identity assertions in form of attributes to the application(s).

8

Home Organisation

IdP

Resource

SP Application


© 2010 SWITCH 9

AuthorizationUser Administration Authentication Resource Credentials

• No user registration anduser data maintenance at resource needed

• Single login processfor the users

• Many new resources available for the users

• Authorization independentof location

• Efficient implementation of inter-institutional access

The Advantages of AAI

University A

Library B

University C

AAI

Student Adm

Web Portal

e-Learning

Literature DB

e-Learning

Research DB

e-Journals


© 2010 SWITCH 10

• Open Source developed by

• Word Shibboleth was used to identify members of a group

• Based on Security Assertion Markup Language (SAML)

• Internationally used (mostly in academic sector)

http://shibboleth.internet2.edu

Shibboleth - The Software Behind AAI




© 2010 SWITCH

AAI - Authentication and Authorization Infrastructure

11

SP

IdP IdP

IdP

SP

SP

SP SP SP

SP

SP SP

Federation

Users

Service Provider Identity

Provider


© 2010 SWITCH

Shibboleth – The components

12

SPIdP Service Provider (SP) • Protects web-application• Enforces authentication

Identity Provider (IdP) • Authenticates user• Asserts identities


© 2010 SWITCH 13

Shibboleth Service Provider for Apache/IIS

•Runs on: Linux, Solaris, Windows, Mac OS X, FreeBSD, …

•Protects static contentand web applications

• shibd fetches attributes

•Authorizes users using!Apache directives!Shibboleth XML Access rules

•Provides attributes to applications!Alternative authorization method

Apache/IISWeb server

Modulesmod_shib mod_php mod_jk

PHP Application Tomcat

Java Application 1

Java Application 2

shibd


© 2010 SWITCH

Login Procedure from User’s View

14

Application receives user’s attributes

User's Home Org Resource

Where Are You From?

https://www.wayf.ex/

Select your Home Organization

Submit

University AUniversity BHospital C

University B Login Page

https://www.uni-b.ex/

User name hmuster

Authenticate yourself

Password ****

Cancel OK

Welcome at Resource

https://www.resource.ex/

Hans Muster's Content:Your Online Content:Medical Training 1Medical Training 2Live Stream 3...

https://www.resource.ex/

ResourceWAYF

Service

Provide credentialsChoose Home Org.(not always necessary)

Use ResourceAccess Resource


© 2010 SWITCH 15

How to Use AAI Attributes in Application

PHP

$email = $_SERVER['Shib-InetOrgPerson-mail'];

Perl

$email =$ENV{'Shib-InetOrgPerson-mail'};

Java

String email = "";email = request.getHeader("Shib-InetOrgPerson-mail");

On Shibboleth-protected pages, user attributes can be directly read from web server environment.


© 2010 SWITCH 16

PersonalUnique IdentifierSurnameGiven nameE-mail

User IDMatriculation numberEmployee numberAddress(es)Phone number(s)Preferred languageDate of birthGender

Group MembershipHome Organization NameHome Organization TypeAffiliation

Study branchStudy levelStaff categoryGroup membershipOrganization PathOrganizational Unit Path

Attributes That Are Available in AAI

Implementation of Attributes! Mandatory ! Recommended or optional

Based on! eduPerson Attributes! “Schweizerisches

Hochschulinformations-system” (SHIS)

NO password (in general)

http://www.switch.ch/aai/attributes


© 2010 SWITCH 17

https://spaces.internet2.edu/display/SHIB2/ShibEnabled

Some Already Shibbolized Applications

Information Providers:Information Providers: Learning Management Systems:

Other Systems:Other Systems:

• American Chemical Society• ArtSTOR• Atypon• CSA• Digitalbrain PLC• EBSCO Publishing• Elsevier ScienceDirect• ExLibris• H.W. Wilson• JSTOR• The Literary Encyclopedia• Metapress

• NSDL• OCLC• Ovid Technologies Inc.• Project MUSE• Proquest Information and Learning• Serials Solutions• SCRAN• Schweizerisches Bundesgericht• Thomson Gale• Thomson Reuters• Useful Utilities - EZproxy

• Blackboard• CLIX• Fronter• ILIAS• INSTRUCT• Moodle• OLAT• Sakai• WebAssign• WebCT

• Bodington.org• Condor• Confluence Wiki• Darwin Streaming Server• Drupal• DSpace• eAcademy• Fedora Repository• Google Apps/Email• GridSphere• GridShib• Higher Markets• Horde• Hupnet

• JISCmail • LionShare• Media Wiki• Microsoft• MyProxy• Napster• PHEAA• Sharepoint® from Microsoft• SYMPA• Symplicity• TurnItIn• TWiki• uPortal• WordPress• Zope + Plone\

More up-to-date and comprehensive list:




© 2010 SWITCH

Questions to Consider Before Integration

Feasibility• Can I modify the application logic/code at all?• Is the application open source or is there an API?

Level of Integration• How much shall be integrated?• Authentication? Authorization? Enrollment? Logout?De-provisioning?

Sustainability• Can changes be included in official source tree?• What happens after version 1.0 or in cases of bugs?

18


© 2010 SWITCH

Levels of Integration

How deep shall the integration go?

1. Authentication

2. Registration/Provisioning

3. Enrollment

4. (Single) Logout

5. Account Deletion/De-provisioning

19


© 2010 SWITCH

1. Authentication

• Simple case:Application relies on external session managementlike HTTP Basic Auth.Shibboleth can then set the REMOTE_USER header variable with an AAI attribute.(This is one of the presented approaches for SAP)

• More complex case:Application uses it’s own session management. Application code must be extended to set up application session using AAI attributes.Examples: Almost all e-learning applications

20


© 2010 SWITCH

2. Registration/Provisioning

• Create a user entry within the application based on AAI attributes the first time a user accesses the application.

• Update user data using AAI attributes• Available already in quite some web applications:Moodle, BSCW, ILIAS, ...

• Example:MoodleShibbolethSettings

21


© 2010 SWITCH

3. (Auto-) Enrollment

• Assign a user privileges or roles based on attributes

• Not available in many web applications yet:Available e.g. in ILIAS (see next slide)

• Should become more common in the future with the establishment of Virtual Organizations (VO)

22


© 2010 SWITCH

4. (Single) Logout

• Single-Log-In is “easy” but what about logout?

• Only concerns applications with own session management • Logout implemented in Moodle, ILIAS and a few other web applications but support in Identity Provider still missing.

• “Inedible cookies, sticky sessions and false hopes”http://switch.ch/export/sites/default/uni/security/aai/event/aai-info-day-2009/slides/AAI-ID09-51-SLO.pdf

24


http://www.switch.ch/export/sites/default/uni/security/aai/event/aai-info-day-2009/slides/AAI-ID09-51-SLO.pdf




© 2010 SWITCH

5. Account Deletion/De-Provisioning

• How to get rid of user entries of users who left an organization on application side?

• No solution in production yet!“How to find and kill zombie users”http://switch.ch/aai/support/presentations/opcom-200909/AAI-OpCom-Account-Checking.pdf

25


http://www.switch.ch/aai/support/presentations/opcom-200909/AAI-OpCom-Account-Checking.pdf




© 2010 SWITCH

Technical Integration Issues

• Login name vs user name vs screen nameSometimes no attribute can be used as username• Generate screen name (e.g. ILIAS) or ask user for one (e.g. OLAT)

• Password is not available as attribute• Generate random password. Won’t be used in general.

• Related Non-Web services are not (yet) Shib-enabled• Provide way for user to set password for that service

• Federation-specific attribute names and values• Provide mapping between Shibboleth and application attributes• Provide hook or API to do conversion/transformation

26


© 2010 SWITCH

Short Summary for Developers

• Shibboleth works with anything running behind Apache/IISCGI, PHP, Perl, Python, Java (via Tomcat), .Net, Ruby, ...

• Shibboleth enforces authentication and authorization Files, Directories, Sub-Directories, Locations

• Shibboleth attributes available in web server environmentNo API or library is needed to read them.

27


web app aai integration - switch · 2010-08-27 · web app aai integration how to integrate web...

Documents